tui-wireguard

## tui-wireguard v0.5.2

tui-wireguard 0.5.2

- **Forwarding server on firewalld (#30).** When firewalld is running, `N` as a forwarding server writes a firewalld policy into the conf instead of iptables FORWARD and MASQUERADE rules, which firewalld's own forward chain overruled. PostUp creates the policy `<interface>-fwd` (ingress ANY, egress the egress NIC's zone, accept and masquerade scoped to the peers' network and each destination) with `firewall-cmd --permanent` and reloads; PostDown deletes it and reloads, so `down` puts firewalld back as it was. The dialog says that each reload drops runtime-only firewalld changes.
- **The WireGuard interface is bound to the zone it falls into** (and unbound at `down`) only when the egress NIC is not bound to a zone either: firewalld dispatches no policy between two interfaces that are both only in the default zone's catch-all. With a NIC NetworkManager manages, nothing is bound.
- **Known limitation, Ubuntu 26.04:** its AppArmor `wg-quick` profile denies the hooks' `sysctl -w net.ipv4.ip_forward=1`, so a forwarding server there needs `ip_forward` turned on by hand (documented in the README). Not new in this release.
- **Port step on a firewalld forwarding server** is `firewall-cmd --permanent --add-port=<port>/udp`, since the interface's reload at `up` would drop a runtime-only port.
- **FORWARD column and `--check` read firewalld** (`firewall-cmd --list-all-policies` and `--list-all-zones`) when it is running. `--check` adds `forwardingChecked`, `forwardingSource` (`firewalld` or `iptables`) and `forwardingManager` (`firewalld` or `ufw`).
- ufw hosts and hosts with a plain nftables or iptables ruleset keep the iptables rules and read.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* be4edba429b5c6bb01bd8714c3f04f08124cbc74 0.5.2: forwarding server on firewalld builds a firewalld policy and reads it back (#30) (#31)

## tui-wireguard v0.5.1

tui-wireguard 0.5.1

- **Add peer: endpoint and persistent keepalive (#27).** After the key line, `a` asks for the peer's endpoint (`host:port` or `[v6]:port`, validated) and a persistent keepalive (0-65535 seconds, empty or 0 is off, prefilled with 25 once an endpoint is given). Both are optional and land on the one previewed `wg set … endpoint … persistent-keepalive …`, so `wg-quick save` persists them and the peers screen shows them (ENDPOINT, KEEP). A bad value reopens its step with the value as typed and the reason; a bad key line is reported before the optional steps open.
- **UDP IN reads the firewall in charge (#28).** The interfaces screen's UDP IN column and `--check`'s `listenPortInput` now read `tui-firewall --check` when tui-firewall is installed, else `nft -j list ruleset` (following jumps and gotos into user chains), else `iptables -S`. firewalld's rules, in its own nftables table, are seen at last. Undetermined (a jump that cannot be followed, a firewalld service whose ports are unknown) reads `?` / `unknown`, never closed. `--check` adds `firewallSource` and `firewallManager`.
- **Port step on firewalld.** The create wizard opens the listen port with `firewall-cmd --add-port=<port>/udp` on a firewalld host (an iptables INPUT rule sits in a table firewalld's reject never consults), and each firewall gets its own "to keep it" hint (`firewall-cmd --permanent`, `ufw allow`, `netfilter-persistent save`).
- **tui-kit v0.4.4**: runner children get no controlling terminal (a prompt fails fast instead of hanging behind the TUI); a failed step's status line goes through `runner.StatusLine`. `go get -u` on the rest.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* fd9c9b77063f82c06637adc92ab70eaf1c7b7d31 0.5.1: endpoint and keepalive on add-peer; firewall-aware UDP IN; tui-kit v0.4.4 (#27 #28) (#29)

## tui-wireguard v0.5.0

tui-wireguard 0.5.0: tui-vpn is now tui-wireguard

WireGuard interfaces and peers from the terminal: status, peers, a new interface as an endpoint or as a forwarding server (IP forwarding, FORWARD rules, NAT and the listen port previewed together), persistence with wg-quick, and a down interface kept on screen so it can be brought back up. The Headscale control plane moved to tui-tailscale. The package replaces tui-vpn on apt, dnf and pacman; configuration under the old tui-vpn paths is still read. Built with tui-kit v0.4.3.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 4ed006336bde3be37a7e5a4ac77fd952b0ad5188 Become tui-wireguard: WireGuard only; Headscale moved to tui-tailscale (#26)
* cb69e9ce337e0a9cc97b777434d2ac7cc65ac0c0 Host validation, stopped-unit screens, OIDC presets, forwarding server, routes approval (#25)

## tui-vpn v0.4.0

Control plane from the tool: transport choice (plain http, Let's Encrypt, own certificate, reverse proxy) and MagicDNS base domain in S, enable at boot, state ownership check and fix. Validated on a real Ubuntu 24.04 host: Let's Encrypt on 443, OIDC against Google, first node registered through the browser.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 08b566642c8e15acca99b3cfdac9f0d5f359aedb Bump anchore/sbom-action/download-syft in the github-actions group (#11)
* 2951e47b9677936c9a9f7313c071347d453d5e40 Bump the github-actions group with 4 updates (#12)
* ca09f2086ae9a48fe699d246e2f04c791b38b5c4 Control plane: transport choice, unit enable, state ownership (#20)
* a7f73deaa89f1b8157266641473dd807ee828b90 README: link the tool's page on tui.tools (#10)
* e4d32534fe6c9d40ef018044aee4bb1a9cb99992 README: point the install snippet at the current release (#9)

## tui-vpn v0.3.0

v0.3.0: headscale server settings and OIDC identity provider setup from the users screen

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* e305fd9bb243a155c5f7c6c362e30987fb13692a Manage the control plane's identity, not just report on it (#8)

## tui-vpn v0.2.1

tui-kit v0.3.0: the dialogs wrap and scroll instead of clipping the
command preview, and the picker filters as you type.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* acb05fbcbb276183df33e515d6050cf3c615e520 Bump tui-kit to v0.3.0 (#7)
* 35cc8c9bdf18225d1372b40982fcce3b97fc1271 tool.json: released (#6)

## tui-vpn v0.2.0

Manage, not view: create and edit from the TUI (wave 1), lab-validated on the router image.

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* b40ba2f90774e40ed7a58ca7c5168f78e5dc5e55 Manage, not view: interface bootstrap, persistence, preauth create, node ops (#5)

## tui-vpn v0.1.0

First validated release: the router-1.0 lab ran this tool against real VMs (tui-lab router topology).

Built by this repository's CI on the tag itself. Each archive ships a
CycloneDX SBOM, `checksums.txt` carries a keyless cosign signature, and
every file has SLSA build provenance — see the README's "Verify a
download" for the two commands that check them.

The commits in this release:

## Changelog
* 237b88f9ebabbd872cd7bb1a79bf54642ee2816a Bump anchore/sbom-action/download-syft in the github-actions group (#1)
* 99ad5cf18e22469b643e1484677e8ea30400367a Initial commit
* 25578d404a7274369384ba7bdbfc64b5dbe02a2b Phase 1: WireGuard + Headscale (read-mostly, previewed mutations) (#2)
* e546638c2dc3256e2bbfe71931a52ce573c895c8 Render the screenshots from the demo, and name them for the real screens (#3)
* 9bf282e20ba44ac03ccb28d62ba4ef8cac86c62b headscale: read the gRPC-gateway build's protobuf-json (0.2x), not just ogen (#4)